The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with api.ashbyhq.com, which is the official and well-known endpoint for the Ashby recruiting platform.
[COMMAND_EXECUTION]: Provides template curl commands for common recruiting tasks such as listing candidates, searching applications, and adding notes. These commands are standard for API interaction.
[CREDENTIALS_UNSAFE]: References the ASHBY_TOKEN environment variable for authentication. This is consistent with safe practices for managing API keys in agentic environments.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from Ashby's API (e.g., candidate names, job descriptions, and notes). While this represents an attack surface for indirect prompt injection from externally controlled data, the skill follows standard integration patterns for an ATS.
Ingestion points: API responses from candidate.list, candidate.search, application.list, and other Ashby endpoints.
Boundary markers: None specified in the instructions.
Capability inventory: Performs network requests via curl and allows writing data via candidate.createNote.
Sanitization: No explicit sanitization or validation of the API response data is described.

ashby